某局点S7506X-G portal认证频繁上下线

S7506X-G portal认证频繁上下线

1、终端portal认证成功后，立马就掉了，配置暂无问题。

2、查看debug信息可以看到，交互完radius报文后，交换机发送了：
Portal sent 46 bytes of packet: Type=ack_auth(4), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:205 2024 SW-CORE PORTAL/7/PACKET:
[ 11 SESSIONID           ] [  8] [000e-xxxx-xxxx]
[ 10 BASIP               ] [  6] [192.168.x.x]

3、然后服务器回：
Portal received 32 bytes of packet: Type=aff_ack_auth(7), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:400 2024 SW-CORE PORTAL/7/PACKET:
02 07 01 00 31 a1 00 00 c0 a8 32 01 00 00 00 00
38 bc 63 00 64 de 82 ee 58 e6 98 5c 8d 28 a6 18
说明此时认证完成结束了。

但是紧接着，交换机发了logout报文，导致认证用户下线：
*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET:
Portal sent 63 bytes of packet: Type=ntf_logout(8), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET:
[  5 TEXTINFO            ] [ 25] [Failed to set user rule]
[ 10 BASIP               ] [  6] [192.168.x.x]

4、服务器侧报错：

5、debug发送下线报文的原因是Failed to set user rule，一般是acl资源不足或者是AAA服务器下发而设备不能正常执行的授权规则导致的acl资源我看过是足够的，怀疑是aaa那边下发了设备无法执行的授权规则。但是后续将domain域里的授权改为none了之后故障依旧。

6、debug报错，底层acl规则不支持匹配聚合：

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/RULE: 

 DRV_USER_RULE:

   L2 Interface     = Bridge-Aggregation99

    L3 Interface     = Vlan-interface50

    VLAN             = 50

    SrcIP            = 192.168.x.x

    SrcMAC           = 000e-xxxx-xxxx

    AuthorACL        = 4294967295

    Operation        = 1

    SetDrvFlag       = 0

    TrafficLevelNum  = 0

    TrafficLevelMap  = 0x0

    TrafficActiOnMap= 0x0

    UserID           = 268437813

    VrfIndex         = 0

    AclMismatchAction= 0

    MicroSegmentID   = 0

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Start scanning traffic send work.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread message cache timer callback : cnt 1.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread begins processing queue message.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread list is not empty.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET: 

Portal sent 63 bytes of packet: Type=ntf_logout(8), ErrCode=0, IP=192.168.x.x

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET: 

[  5 TEXTINFO            ] [ 25] [Failed to set user rule]

[ 10 BASIP               ] [  6] [192.168.x.x]

开启portal用户漫游功能，聚合口开启portal roaming enable功能后问题解决。